From 5ab5ce56ecb7003a27ebc45cb776e0a03019648f Mon Sep 17 00:00:00 2001 From: Tom Softreck Date: Sat, 5 Sep 2026 22:16:16 +0200 Subject: [PATCH] deps: track stable internal releases and verify supported Python --- .github/dependabot.yml | 28 +++++++++++ .github/internal-dependencies.json | 29 +++++++++++ .../internal-dependency-freshness.yml | 36 +++++++++++++ .github/workflows/test-locked.yml | 30 +++++++++++ README.md | 4 ++ docs/dependencies.md | 28 +++++++++++ pyproject.toml | 13 ++--- src/clickmd/renderer.py | 4 +- uv.lock | 50 ++++++++++--------- 9 files changed, 191 insertions(+), 31 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/internal-dependencies.json create mode 100644 .github/workflows/internal-dependency-freshness.yml create mode 100644 .github/workflows/test-locked.yml create mode 100644 docs/dependencies.md diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..2f819e0 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,28 @@ +version: 2 +updates: +- package-ecosystem: uv + directory: / + schedule: + interval: cron + cronjob: 12 4 * * * + timezone: Europe/Warsaw + open-pull-requests-limit: 1 + versioning-strategy: increase-if-necessary + allow: + - dependency-name: costs + dependency-type: all + - dependency-name: goal + dependency-type: all + - dependency-name: pfix + dependency-type: all + - dependency-name: code2llm + dependency-type: all + groups: + internal-packages: + patterns: + - costs + - goal + - pfix + - code2llm + commit-message: + prefix: deps diff --git a/.github/internal-dependencies.json b/.github/internal-dependencies.json new file mode 100644 index 0000000..d327dd7 --- /dev/null +++ b/.github/internal-dependencies.json @@ -0,0 +1,29 @@ +{ + "schema": "goal.internal-dependencies/v1", + "packages": [ + { + "name": "costs", + "repository": "semcod/costs", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "goal", + "repository": "semcod/goal", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "pfix", + "repository": "semcod/pfix", + "registry": "pypi", + "versioning": "semver" + }, + { + "name": "code2llm", + "repository": "semcod/code2llm", + "registry": "pypi", + "versioning": "semver" + } + ] +} diff --git a/.github/workflows/internal-dependency-freshness.yml b/.github/workflows/internal-dependency-freshness.yml new file mode 100644 index 0000000..d64bfc8 --- /dev/null +++ b/.github/workflows/internal-dependency-freshness.yml @@ -0,0 +1,36 @@ +name: Internal dependency freshness + +on: + schedule: + - cron: "47 5 * * *" + workflow_dispatch: + pull_request: + paths: + - pyproject.toml + - uv.lock + - .github/internal-dependencies.json + - .github/workflows/internal-dependency-freshness.yml + +permissions: + contents: read + +jobs: + freshness: + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 + with: + python-version: "3.12" + - name: Install released checker + run: python -m pip install "goal==2.2.0" + - name: Verify published stable targets + run: goal dependencies --catalog .github/internal-dependencies.json --check > dependency-freshness.json + - name: Retain freshness evidence + if: always() + uses: actions/upload-artifact@v4 + with: + name: dependency-freshness + path: dependency-freshness.json + if-no-files-found: ignore diff --git a/.github/workflows/test-locked.yml b/.github/workflows/test-locked.yml new file mode 100644 index 0000000..fdffa64 --- /dev/null +++ b/.github/workflows/test-locked.yml @@ -0,0 +1,30 @@ +name: Locked tests + +on: + push: + branches: [main] + pull_request: + branches: [main] + workflow_dispatch: + +permissions: + contents: read + +jobs: + test: + runs-on: ubuntu-latest + timeout-minutes: 15 + strategy: + fail-fast: false + matrix: + python-version: ["3.10", "3.13"] + steps: + - uses: actions/checkout@v7 + - uses: actions/setup-python@v7 + with: + python-version: ${{ matrix.python-version }} + - run: python -m pip install uv + - name: Install locked test dependencies + run: uv sync --locked --extra dev --extra click --extra rich --python "${{ matrix.python-version }}" + - name: Test supported Python versions + run: uv run --no-sync python -m pytest -q diff --git a/README.md b/README.md index f2101a7..93d82cd 100644 --- a/README.md +++ b/README.md @@ -430,3 +430,7 @@ _Last updated by [taskill](https://github.com/oqlos/taskill) at 2026-04-25 18:20 > No changes since the last taskill run: there are no new commits and no changed files. TODO.md remains unchanged. + +## Dependency maintenance + +See [dependency updates and Python tool groups](docs/dependencies.md) for locked tests, daily updates and freshness checks. diff --git a/docs/dependencies.md b/docs/dependencies.md new file mode 100644 index 0000000..1a14053 --- /dev/null +++ b/docs/dependencies.md @@ -0,0 +1,28 @@ +# Internal dependency updates + +This repository owns its dependency configuration and this guide. The shared checker is maintained in [semcod/goal](https://github.com/semcod/goal/blob/84f18540d14c24cc8ff5b7f202d2874344779ecc/docs/internal-dependencies.md). Documentation follows the repository ownership principle in [wellmanifest/docs](https://github.com/wellmanifest/docs/blob/f64de5806577769672ebc1730d2e144b4c7671ec/README.md). + +## Python support and tools + +Application Python support remains `>=3.10`. Goal is used as a development/release tool; source inspection found no Goal imports or executable invocation in the application Python code. Its old declarations (runtime, dev) moved to an `automation` dependency group requiring Python >=3.12. The normal dev/test installation remains usable on the application's minimum Python version. + +```sh +uv sync --locked --extra dev +uv sync --locked --group automation --python 3.12 +``` + +The second command selects an automation environment; use a separate UV_PROJECT_ENVIRONMENT when keeping application and tool environments side by side. `clickmd` itself is excluded from the registry catalog when it is the local editable package. + +## Daily updates and verification + +[Dependabot configuration](../.github/dependabot.yml) checks the explicit internal package allowlist daily, including weekends, and groups updates in one PR. It includes transitive dependencies and may widen a manifest constraint when needed. Local or Git sources require separate review. + +[Freshness CI](../.github/workflows/internal-dependency-freshness.yml) compares uv.lock with the highest published stable three-part versions using Goal 2.2.0. It runs daily, manually and on dependency PRs, has read-only repository permissions and retains JSON evidence. Resolver failures and mismatched targets stay visible. A successful audit says nothing about an already installed development or production environment. + +[Locked tests](../.github/workflows/test-locked.yml) run on Python 3.10 and 3.13 before merge. Update creation does not grant merge approval. The `>=` declarations alone do not refresh uv.lock; environments must be synchronized after a tested update is merged. + +## Delivery record + +This change updates the internal packages to the registry targets observed on 2026-09-05, preserves application Python support and adds the scheduled checks above. Test and publication results are recorded in this repository's PR and Actions checks. The ecosystem rollout history is maintained in [costs documentation](https://github.com/semcod/costs/tree/main/docs/dependencies). + +The minimum-Python test run also exposed invalid nested f-string syntax in JSON highlighting. The renderer now formats quoted keys and values with Python 3.10-compatible expressions; the existing renderer suite checks the behavior. diff --git a/pyproject.toml b/pyproject.toml index 0e4fbde..7bd021e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -27,11 +27,7 @@ classifiers = [ "Typing :: Typed", ] requires-python = ">=3.10" -dependencies = [ - "goal>=2.1.218", - "costs>=0.1.20", - "pfix>=0.1.60", -] +dependencies = ["costs>=0.1.20", "pfix>=0.1.60"] [project.optional-dependencies] click = ["click>=8.0,<9.0"] @@ -44,7 +40,6 @@ dev = [ "black>=23.0", "build>=1.0", "twine>=5.0", - "goal>=2.1.218", "costs>=0.1.20", "pfix>=0.1.60", ] @@ -124,3 +119,9 @@ max_commits = 500 # Cost thresholds for badge colors (USD) badge_color_thresholds = { low = 1.0, medium = 5.0, high = 10.0, critical = 50.0 } + +[tool.uv.dependency-groups] +automation = {requires-python = ">=3.12"} + +[dependency-groups] +automation = ["goal>=2.2.0"] diff --git a/src/clickmd/renderer.py b/src/clickmd/renderer.py index 4488248..05cabd6 100644 --- a/src/clickmd/renderer.py +++ b/src/clickmd/renderer.py @@ -300,8 +300,8 @@ def _highlight_yaml(self, line: str) -> str: def _highlight_json(self, line: str) -> str: result = line - result = re.sub(r'"([^"]+)":', lambda m: f"{self._c('cyan', f'\"{m.group(1)}\"')}:" , result) - result = re.sub(r':\s*"([^"]*)"', lambda m: f": {self._c('green', f'\"{m.group(1)}\"')}" , result) + result = re.sub(r'"([^"]+)":', lambda m: self._c("cyan", m.group(0)[:-1]) + ":", result) + result = re.sub(r':\s*"([^"]*)"', lambda m: ": " + self._c("green", '"' + m.group(1) + '"'), result) result = re.sub(r":\s*(\d+)", lambda m: f": {self._c('magenta', m.group(1))}" , result) result = re.sub(r":\s*(true|false)", lambda m: f": {self._c('yellow', m.group(1))}" , result) result = re.sub(r":\s*null", f": {self._c('gray', 'null')}", result) diff --git a/uv.lock b/uv.lock index 0f845f8..100ec40 100644 --- a/uv.lock +++ b/uv.lock @@ -626,7 +626,6 @@ version = "1.1.15" source = { editable = "." } dependencies = [ { name = "costs" }, - { name = "goal" }, { name = "pfix" }, ] @@ -636,7 +635,6 @@ all = [ { name = "build" }, { name = "click" }, { name = "costs" }, - { name = "goal" }, { name = "mypy" }, { name = "pfix" }, { name = "pytest" }, @@ -652,7 +650,6 @@ dev = [ { name = "black" }, { name = "build" }, { name = "costs" }, - { name = "goal" }, { name = "mypy" }, { name = "pfix" }, { name = "pytest" }, @@ -664,6 +661,11 @@ rich = [ { name = "rich" }, ] +[package.dev-dependencies] +automation = [ + { name = "goal", marker = "python_full_version >= '3.12'" }, +] + [package.metadata] requires-dist = [ { name = "black", marker = "extra == 'dev'", specifier = ">=23.0" }, @@ -672,8 +674,6 @@ requires-dist = [ { name = "clickmd", extras = ["click", "rich", "dev"], marker = "extra == 'all'" }, { name = "costs", specifier = ">=0.1.20" }, { name = "costs", marker = "extra == 'dev'", specifier = ">=0.1.20" }, - { name = "goal", specifier = ">=2.1.218" }, - { name = "goal", marker = "extra == 'dev'", specifier = ">=2.1.218" }, { name = "mypy", marker = "extra == 'dev'", specifier = ">=1.0" }, { name = "pfix", specifier = ">=0.1.60" }, { name = "pfix", marker = "extra == 'dev'", specifier = ">=0.1.60" }, @@ -685,6 +685,9 @@ requires-dist = [ ] provides-extras = ["click", "rich", "dev", "all"] +[package.metadata.requires-dev] +automation = [{ name = "goal", marker = "python_full_version >= '3.12'", specifier = ">=2.2.0" }] + [[package]] name = "colorama" version = "0.4.6" @@ -696,7 +699,7 @@ wheels = [ [[package]] name = "costs" -version = "0.1.53" +version = "0.2.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "anthropic" }, @@ -708,11 +711,12 @@ dependencies = [ { name = "pandas", version = "3.0.3", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.11'" }, { name = "python-dotenv" }, { name = "tiktoken" }, + { name = "tomli", marker = "python_full_version < '3.11'" }, { name = "typer" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/64/02/126b813e063a47c7e7efef481ac144747f94fd05ae39ee9d5c3c6253a09f/costs-0.1.53.tar.gz", hash = "sha256:9f9f76a9e523e899b72a658c574e33145f0f25b97554c15f70dc714206d3d8ca", size = 30980, upload-time = "2026-07-02T14:11:25.407Z" } +sdist = { url = "https://files.pythonhosted.org/packages/e4/6f/7f3c72d6d4b5264bd5a3447e18a3b5184bffee143f72c8d023bb759afd1a/costs-0.2.0.tar.gz", hash = "sha256:3782bae859725dae30f697b5f3e5aa5d84e06feadebc5782ae706e21d46437af", size = 44606, upload-time = "2026-09-05T15:49:55.524Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/bd/0e/a6c82f642985c19f6b42a86e5aaf54086fab4ab3771d54e932ec78a7d577/costs-0.1.53-py3-none-any.whl", hash = "sha256:2795668c83a5974c66b1fb6d7831248a481e1bb009f68c4b345d74d357205b88", size = 35990, upload-time = "2026-07-02T14:11:24.146Z" }, + { url = "https://files.pythonhosted.org/packages/1d/7e/fc91d9fdc7a1ceb9116daffab27124a54f6e8887c9d59d906df43dcbfa6a/costs-0.2.0-py3-none-any.whl", hash = "sha256:4798b8535cbbcbb354e440ebce91365f17c910414bf5831a0610998ae6e679af", size = 48625, upload-time = "2026-09-05T15:49:54.054Z" }, ] [[package]] @@ -823,7 +827,7 @@ name = "cryptography" version = "49.0.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "cffi", marker = "(python_full_version < '3.11' and platform_python_implementation != 'PyPy' and sys_platform == 'emscripten') or (python_full_version < '3.11' and platform_python_implementation != 'PyPy' and sys_platform == 'win32') or (platform_python_implementation != 'PyPy' and sys_platform != 'emscripten' and sys_platform != 'win32')" }, + { name = "cffi", marker = "platform_python_implementation != 'PyPy'" }, { name = "typing-extensions", marker = "python_full_version < '3.11'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/1f/99/d1c90d6041656cc6ee229dc99cd67fd0cd5aec3c5f7d72fffc27cc750054/cryptography-49.0.0.tar.gz", hash = "sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493", size = 854345, upload-time = "2026-06-12T20:02:30.512Z" } @@ -917,7 +921,7 @@ name = "exceptiongroup" version = "1.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "typing-extensions", marker = "python_full_version < '3.13'" }, + { name = "typing-extensions" }, ] sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" } wheels = [ @@ -1170,7 +1174,7 @@ wheels = [ [[package]] name = "goal" -version = "2.1.270" +version = "2.2.0" source = { registry = "https://pypi.org/simple" } dependencies = [ { name = "click" }, @@ -1180,9 +1184,9 @@ dependencies = [ { name = "tomlkit" }, { name = "typer" }, ] -sdist = { url = "https://files.pythonhosted.org/packages/1b/9a/30d526ae0dc702f5905f3737fdd87923881d1428aac66a0120b978ccfce3/goal-2.1.270.tar.gz", hash = "sha256:c7e703dfde09a8c4e45be2121e7b4800cac29caa394216ccd68fbf6b9e7e5beb", size = 314250, upload-time = "2026-07-05T22:44:21.553Z" } +sdist = { url = "https://files.pythonhosted.org/packages/c7/9c/135e3f67a7324c3c49ef4246f5518b59ad90226e62c3d30ae20cba005c1d/goal-2.2.0.tar.gz", hash = "sha256:e9e2c1ac9493dae3b887b16d503f7c1f83d02ddcbdd3c5cf58d44a458bb2662f", size = 399786, upload-time = "2026-09-05T19:41:55.329Z" } wheels = [ - { url = "https://files.pythonhosted.org/packages/a5/9e/1fc3083be237dcfa24b83a3f9d3bb5661e0c3288e98bb42fa1ab175d595b/goal-2.1.270-py3-none-any.whl", hash = "sha256:1261177669c543f7b14fd473da1952246ee96d3ef0d0e23a18e3813fc00cb6bb", size = 295880, upload-time = "2026-07-05T22:44:19.182Z" }, + { url = "https://files.pythonhosted.org/packages/24/69/8a4cf5710683bb777f1f6e4cd44dd3907befe97b94c6ea6e97d4305b4e44/goal-2.2.0-py3-none-any.whl", hash = "sha256:0d8f93aa317ac92a66b64b797e210a5d66044ce8db2cb05b012b03d42aced95e", size = 349709, upload-time = "2026-09-05T19:41:53.615Z" }, ] [[package]] @@ -2383,10 +2387,10 @@ resolution-markers = [ "python_full_version < '3.11'", ] dependencies = [ - { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.11'" }, - { name = "python-dateutil", marker = "python_full_version < '3.11'" }, - { name = "pytz", marker = "python_full_version < '3.11'" }, - { name = "tzdata", marker = "python_full_version < '3.11'" }, + { name = "numpy", version = "2.2.6", source = { registry = "https://pypi.org/simple" } }, + { name = "python-dateutil" }, + { name = "pytz" }, + { name = "tzdata" }, ] sdist = { url = "https://files.pythonhosted.org/packages/33/01/d40b85317f86cf08d853a4f495195c73815fdf205eef3993821720274518/pandas-2.3.3.tar.gz", hash = "sha256:e05e1af93b977f7eafa636d043f9f94c7ee3ac81af99c13508215942e64c993b", size = 4495223, upload-time = "2025-09-29T23:34:51.853Z" } wheels = [ @@ -2458,10 +2462,10 @@ resolution-markers = [ "python_full_version == '3.11.*' and sys_platform != 'emscripten' and sys_platform != 'win32'", ] dependencies = [ - { name = "numpy", version = "2.4.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version == '3.11.*'" }, + { name = "numpy", version = "2.4.6", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version < '3.12'" }, { name = "numpy", version = "2.5.1", source = { registry = "https://pypi.org/simple" }, marker = "python_full_version >= '3.12'" }, - { name = "python-dateutil", marker = "python_full_version >= '3.11'" }, - { name = "tzdata", marker = "(python_full_version >= '3.11' and sys_platform == 'emscripten') or (python_full_version >= '3.11' and sys_platform == 'win32')" }, + { name = "python-dateutil" }, + { name = "tzdata", marker = "sys_platform == 'emscripten' or sys_platform == 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/f8/87/4341c6252d1c47b08768c3d25ac487362bf403f0313ddae4a2a26c9b1b4c/pandas-3.0.3.tar.gz", hash = "sha256:696a4a00a2a2a35d4e5deb3fc946641b96c944f02230e4f76137fe35d806c4fc", size = 4651414, upload-time = "2026-05-11T18:54:29.21Z" } wheels = [ @@ -2546,7 +2550,7 @@ name = "pexpect" version = "4.9.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "ptyprocess", marker = "python_full_version < '3.11' or sys_platform != 'win32'" }, + { name = "ptyprocess" }, ] sdist = { url = "https://files.pythonhosted.org/packages/42/92/cc564bf6381ff43ce1f4d06852fc19a2f11d180f23dc32d9588bee2f149d/pexpect-4.9.0.tar.gz", hash = "sha256:ee7d41123f3c9911050ea2c2dac107568dc43b2d3b0c7557a33212c398ead30f", size = 166450, upload-time = "2023-11-25T09:07:26.339Z" } wheels = [ @@ -3665,8 +3669,8 @@ name = "secretstorage" version = "3.5.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "cryptography", marker = "(python_full_version < '3.11' and sys_platform == 'emscripten') or (python_full_version < '3.11' and sys_platform == 'win32') or (sys_platform != 'emscripten' and sys_platform != 'win32')" }, - { name = "jeepney", marker = "(python_full_version < '3.11' and sys_platform == 'emscripten') or (python_full_version < '3.11' and sys_platform == 'win32') or (sys_platform != 'emscripten' and sys_platform != 'win32')" }, + { name = "cryptography" }, + { name = "jeepney" }, ] sdist = { url = "https://files.pythonhosted.org/packages/1c/03/e834bcd866f2f8a49a85eaff47340affa3bfa391ee9912a952a1faa68c7b/secretstorage-3.5.0.tar.gz", hash = "sha256:f04b8e4689cbce351744d5537bf6b1329c6fc68f91fa666f60a380edddcd11be", size = 19884, upload-time = "2025-11-23T19:02:53.191Z" } wheels = [